Lion Worm/crew.tgz

[Alfred Huger <ah () SECURITYFOCUS COM>]

Neil Long <neil.long () computing-services oxford ac uk> mailed me and
mentioned that it might be worth pointing out that the SANS GIAC analysis
is not valid for the crew.tgz version that was sent to Incidents by
Andreas stling <andreaso () IT SU SE>

There is no t0rn rootkit involved and the root shell is on  1008 so their
Lionfind may be misleading.

Of course, they could be half a dozen variants on the loose by this stage.


VP Engineering
SecurityFocus.com
"Vae Victis"